MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d
SHA3-384 hash: eae2955d5eb6607bdc9393221b902efdca65f164074b69013318abc628a252c4668f208439c07f95505c3e5cd8eef2ea
SHA1 hash: a5626c040430f5cf01534d5307a949ebce5f60f3
MD5 hash: 50bcd3e63b1e09fa676c2135ae3cbed5
humanhash: kansas-oklahoma-connecticut-juliet
File name:Installer.iso
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:17'463'296 bytes
First seen:2026-02-13 16:48:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 393216:S7KBlzt7kuvtRuaJxKXLiZVMs4za8TZg/KoHnJHaPS2Dj+Zu:9zzt7k6aL+VwzHg662+Q
TLSH T16A0733F864F88202ECCC297616158AAA00615BB3FF774435F81B5F791AE1077F34A5BA
TrID 88.7% (.NULL) null bytes (2048000/1)
11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.1% (.ISO) ISO 9660 CD image (2545/36/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Magika iso
Reporter aachum
Tags:iso purecrypter PureHVNC PureLogsStealer


Avatar
iamaachum
https://dl89sfilesbase.top/downloads/Eqn0k3rT/AppSetup

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
ES ES
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Archives
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/aa238429-3ed0-4be5-acce-b6909f9491e3/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698f560d1c4b7b977f66510d
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
context-iso crypt obfuscated packed packed soft-404 themidawinlicense xpack
Link:
https://www.filescan.io/uploads/698f5609981ff1d38a550c41/reports/198002ae-b017-483a-b71e-18a6d56d4d8f/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d
Verdict:
Malicious
File Type:
iso
First seen:
2026-02-13T13:59:00Z UTC
Last seen:
2026-02-13T14:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d/
Verdict:
Malicious
Threat:
Trojan.Win32.Agent
Link:
https://tip.neiki.dev/file/0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-02-13 16:49:17 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkvq2ef7awjpxywhxv4gp6wddvccfcudeg656agz4zydd4w3cywq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PureLogsStealer

iso 0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d

(this sample)

PureLogsStealer

Executable exe 86e8702a12469a1b8290eadf4be6751a922a601078fc2cfe1ddb043bcaad99aa

  
Link
https://tria.ge/260213-t2gm8ag14h/behavioral1
  
Delivery method
Distributed via web download
  
Dropping
SHA256 86e8702a12469a1b8290eadf4be6751a922a601078fc2cfe1ddb043bcaad99aa
  
Dropping
MD5 bd6eaca124020ecc58d6d2338cf9e022

Comments